Last updated: 25 October 2026
1. About this policy
This policy explains how TuttoPrep handles personal information when you visit our website, request access, create an account, use learning tools or contact us. “We”, “us” and “our” refer to the operator of TuttoPrep, responsible for the processing described here. Contact legal@tuttoprep.com for privacy questions or requests.
This policy describes processing; it is not a request for blanket consent. Accepting our Terms of Service does not waive your privacy rights.
2. Information we collect
We receive information directly from you, from Google when you choose Google sign-in, and from your browser and service providers when you use the website:
- Account information: name, email address, verification status, profile image if provided, account identifiers, access role, language preference, account dates, sign-in tokens and session information. Google handles your Google password.
- Profile and study preferences: onboarding answers, including country, phone number, education stage, intended intake, study field, university preferences, budget concerns, selected exams and dates, preparation level, scores and goals, study availability and agreement records.
- Learning activity: questions opened, answers and revisions, correctness, time spent, drill sessions, saved filters or templates and learning progress.
- Communications: access-request email addresses, messages and problem reports you send, relevant page or question references, and records of outgoing emails, including recipients, subject, content and delivery status.
- Technical and security information: IP address, approximate country derived from the network, browser and device information, request and error details, security checks and usage counters. Some security records use keyed IP hashes; other records, such as sign-in sessions, may contain IP addresses. Hashing does not make identifiable information anonymous.
Some protected resources display your account email address as a watermark. It may be visible to anyone who sees a screenshot, printout or shared copy.
Public pages can be viewed without an account. Account features and access requests require the information indicated in the relevant forms. You may decline optional information; declining required information can prevent the relevant feature from working. Avoid including sensitive information or another person's private information in messages and reports.
3. How we use information
We use information to operate accounts and sign-in, provide and personalise learning tools, save answers and progress, apply usage limits, respond to requests, send requested updates and service messages, diagnose errors, understand service usage, protect content, prevent abuse and meet legal obligations. Practice scoring and security restrictions use automated checks; they do not determine official exam results or university admissions. Contact us to request review of an apparent error or restriction.
Where applicable law requires a legal basis, processing must rely on an available basis: necessity to provide a service under a valid agreement; legitimate interests in proportionate security, troubleshooting and service improvement where that basis is permitted and does not override your rights; specific legal obligations; or consent where required. A basis available in one country does not automatically apply in another. Optional marketing or processing requiring separate consent is not authorised merely by account creation.
We do not sell personal information or use it for targeted advertising. We use no advertising pixels. Optional public-site analytics, when enabled, requires the separate choice described below. Learning statistics and operational metrics still involve data processing. There is currently no payment checkout or live AI chat processing your messages.
4. Sharing and service providers
Authorised administrators and service providers can access information needed to operate, secure and support the service:
- Cloudflare provides hosting, databases, security, operational logs and metrics, and outgoing email infrastructure. Its Turnstile checks process browser and network signals to detect bots. Cloudflare also describes its own use of these signals to improve detection in its Turnstile Privacy Notice.
- Google provides sign-in and handles information under its Privacy Policy.
- Desmos provides the calculator. When its script loads, your browser connects to Desmos and shares connection and browser information. Its Privacy Policy describes its practices.
- Umami Software, Inc. provides optional public-site analytics when enabled and accepted. Our account uses EU analytics storage. CDN routing, security, support and operational logging can involve processing elsewhere, including the US. See Umami's processing terms and subprocessors. Your analytics choice does not authorise advertising, sale of data or account identification.
Information may also be disclosed where required by law or necessary to address fraud, security incidents or legal claims, subject to applicable protections. Third-party websites you visit through links have their own privacy practices.
Providers operate internationally, and information may be processed outside your country, including in the United States. Where cross-border transfer rules apply, the transfer must meet the relevant legal requirements. Contact us for information about destinations and applicable safeguards; this policy does not itself create a transfer safeguard.
5. Cookies and browser storage
We use cookies and browser storage for sign-in, security, language and appearance preferences, guide progress and saving or retrying answers. Authentication sessions normally last seven days and can renew with activity; the language preference cookie lasts one year. Some preferences and unsynchronised answers remain in local storage or IndexedDB until cleared. Per-tab error-reporting state uses session storage and ends with the tab session. Security providers may also use necessary storage for their checks.
You can manage cookies and clear site data in your browser. Blocking or clearing storage may sign you out, reset preferences or remove unsynchronised answers. Signing out does not necessarily clear all browser data or server records. On shared devices, sign out and clear site data after checking that your work has saved. Where prior consent is legally required for optional storage, it must be obtained; continuing to browse is not consent.
Campaign landing totals
For campaign links saved by our administrators, our server counts successful requests to approved public pages using the campaign labels already present in the requested URL. We keep only the public destination, the five approved UTM labels, the UTC day and a total, for up to 90 days. Unknown campaigns, private pages, authentication parameters and invalid campaign labels are excluded. Administrators must use labels shared by a group and avoid personal information or per-recipient codes. We do not create visitor identifiers, store individual arrival records, link these totals to accounts or forward them to Umami. Identical links share totals; reloads and bots may be counted. These are request totals, not unique visitors, sign-ups or advertising profiles.
This counter uses no analytics cookies, browser storage or additional browser tracking requests and operates independently of your optional Umami choice. Available Global Privacy Control and Do Not Track request signals and browser prefetch signals suppress counting. Cloudflare still receives the normal page request and processes network information to deliver and secure the site, as described above. Our purpose is limited first-party measurement of traffic to public pages. Where receiving requests involves personal data, we rely on proportionate legitimate interests where permitted, subject to applicable notice, objection and transfer requirements. Contact our privacy address to object or ask about this processing.
Optional public-site analytics
When enabled, we ask separately before loading Umami or sending analytics. Allowing analytics helps us understand visits to approved public pages, which campaign links brought visitors, and a few actions: opening the main sign-up prompt, selecting an available plan, starting Google sign-in, or receiving a successful access-request response. These actions do not prove a completed registration, payment or new unique lead. You can reject or close the prompt without affecting the service. If you are under 16, reject optional analytics; this prompt is not a parental-authorisation process.
We send the approved public page path, validated campaign labels (utm_source, utm_medium, utm_campaign, utm_content, utm_term), an external referring hostname when available, and the approved event name. A plan-selection event can include the selected plan category. Campaign labels may follow public-page navigation in memory, ending when you enter a private area, withdraw consent or leave the page session. We do not send account identifiers, emails, form entries, learning activity, calculator inputs or results, full referring URLs, authentication parameters or advertising click IDs. We do not use session replays or heatmaps. Admin, account, practice and other private pages are excluded.
The connection necessarily exposes network information to the provider. Umami documents visitor grouping using the website identifier, IP address, browser User-Agent and a rotating salt. Its standard analytics records do not store raw IP addresses, but operational or security logs can contain network data. Pseudonymous grouping does not make all processing anonymous. The Hobby service retains analytics for six months; provider operational logs and backups can have separate retention periods.
Use Privacy choices in a public-page footer to reject analytics or change your choice at any time. Withdrawal stops future analytics and discards queued events; it does not undo earlier lawful collection. Supported Global Privacy Control and Do Not Track signals keep optional analytics off. Umami uses no analytics cookies. To remember your decision, we store only your choice, time, notice version and a random receipt reference on this device for up to 180 days. That receipt is not sent to Umami or linked to your account. A changed notice or expired choice requires a new decision. Clearing site data removes it; where storage is unavailable, the choice lasts only for the current page session.
Analytics remains disabled until the required provider and legal arrangements are in place. Consent alone does not establish a lawful international-transfer arrangement. Contact our privacy address to exercise rights relating to analytics. Because we do not assign account identifiers to analytics, we may be unable to locate an individual visitor's historical records from an account email alone.
6. Retention, deletion and security
Account and learning records are generally kept while your account is active. There is no single automatic expiry for all account, access-request or communication records. Retention depends on the continuing service purpose, security needs, legal obligations and legal claims.
You can use the account-deletion page, which requires sign-in and confirmation, or contact us for assistance. Deletion removes the account and associated sign-in and learning records, matching access-request entries and matching stored outgoing emails. Account identifiers and stored account email fields are removed from separate incident and problem-report records; report descriptions can remain, so do not assume personal information written into report text is automatically erased.
Grouped incidents are retained for 90 days after their latest occurrence. Daily incident counts are retained for 90 days. Closed problem reports and digest-delivery records are retained for one year; open reports remain until resolved. Copies in provider logs, backups and already delivered emails can have separate retention periods. Deleting an account does not delete your Google account or automatically clear other devices. Browser cleanup applies to the device used for deletion.
We use authentication, access controls, restricted administration and abuse checks to protect information. No online service can guarantee absolute security. Report suspected exposure through our privacy contact without sending passwords or authentication tokens.
7. Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction, a copy or portability of your information, object to processing or withdraw consent. Withdrawing consent affects future processing based on that consent and does not make earlier lawful processing unlawful. You may also complain to the appropriate data-protection authority and exercise other local rights.
Send requests to legal@tuttoprep.com, preferably from your account email. Explain what you need; if you cannot access that address, tell us. We may proportionately verify identity or a representative's authority before acting. We will respond within applicable legal deadlines and explain any lawful limitation. Requests are generally free, subject to exceptions permitted by law. Exercising your rights does not justify retaliation or unlawful discrimination.
8. Young users and policy changes
Independent account use is intended for people aged 16 or older, subject to local law. Under-16 learners need a parent or legal guardian to contact us before registration or submission of personal information. Any required guardian authorisation and verification must be completed first; stricter local rules may also apply to 16–17-year-olds. Contact us if you believe a child has provided information without the required authorisation. We must verify guardian authority before disclosing account information.
We may update this policy as the service or legal requirements change and will show the revised date above. Material changes require appropriate notice and fresh consent where legally required. English and Turkish versions are intended to describe the same practices; translation differences do not reduce your statutory rights.